Oh cripes. That was it. Turns out it was broken and being fixed right as I was trying to get it working for the first time!
As of 10 hours ago, all is revealed here.
In summary, yes, "secure" needs to be set to false, and the key recently changed names from "secureConnection". The incorrect key was being silently ignored, defaulting to true, and sending me on a wild goose chase!
I’ve set "port" back to 587, replaced "secureConnection": false with "secure": false and all is well.